Keycloak admin console not loading with the docker container being behind reverse proxy #41305

nmrsmn · 2025-07-21T22:23:32Z

nmrsmn
Jul 21, 2025

Before reporting an issue

I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

admin/ui

Describe the bug

Whenever I have booted up keycloak using docker compose up -d keycloak and I try to navigate to the administration console from within my own home network the console won't load (keeps loading forever). When I try to open the same url using my phones, not connected to the home network, the console loads just fine. So far keycloak is working perfectly from outside my network. I just don't get it to work properly from my home network, which I really want get working as I use keycloak as the auth server for my app.

My setup:
In my home I've installed a raspberry pi 4 with installed docker. I've created several containers including nginx and keycloak.
I've setup nginx to work as a reverse proxy for a couple of containers and I've used the following setup as my nginx keycloak setup:

# Keycloak
upstream keycloak {
	server 10.5.0.30:8080;
	keepalive 128;
}

server {
	listen 443 ssl;
	listen [::]:443 ssl;
	http2 on;

	server_name keycloak.some.domain;
	server_tokens off;

	ssl_certificate /etc/nginx/ssl/live/keycloak.some.domain/fullchain.pem;
	ssl_certificate_key /etc/nginx/ssl/live/keycloak.some.domain/privkey.pem;
	include /etc/nginx/ssl/options-ssl-nginx.conf;
	ssl_dhparam /etc/nginx/ssl/ssl-dhparams.pem;

	location ^~ /.well-known/acme-challenge/ {
		default_type "text/plain";
		alias /var/www/certbot/.well-known/acme-challenge/;
	}

	location / {
		proxy_pass http://keycloak;
		# proxy_http_version 1.1;

		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_protocol_addr;
		proxy_set_header X-Forwarded-Host $host;
		proxy_set_header X-Forwarded-Server $host;
		proxy_set_header X-Forwarded-Port $server_port;
		proxy_set_header X-Forwarded-Proto $scheme;
		
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection "upgrade";
		
		# proxy_redirect off;
		# proxy_buffering off;
		proxy_buffer_size          128k;
		proxy_buffers              4 256k;
		proxy_busy_buffers_size    256k;

		proxy_send_timeout 86400s;
		proxy_read_timeout 86400s;
    }
}

The docker compose configuration I'm using:

  keycloak:
    image: keycloak/keycloak:26.3.1
    hostname: keycloak
    restart: unless-stopped
    ports:
      - 8080:8080
    entrypoint: ["/opt/keycloak/bin/kc.sh", "start-dev"]
    volumes:
      - /opt/keycloak/data:/var/lib/postgresql/data/:rw
      - /opt/postgres/init:/docker-entrypoint-initdb.d:r
    environment:
      KC_HOSTNAME: https://keycloak.some.domain/
      KC_HOSTNAME_BACKCHANNEL_DYNAMIC: true
      KC_HOSTNAME_DEBUG: true
      KC_HOSTNAME_STRICT: false

      # KC_HTTP_PORT: 8080
      KC_HTTP_ENABLED: true
      # KC_HTTPS_PORT: 8443

      KC_PROXY_HEADERS: xforwarded
      KC_PROXY_ADDRESS_FORWARDING: true

      KC_DB: postgres
      KC_DB_URL_HOST: postgres
      KC_DB_URL_DATABASE: ${KEYCLOAK_DB_NAME}
      KC_DB_USERNAME: ${SMARTHOME_DB_USER}
      KC_DB_PASSWORD: ${SMARTHOME_DB_PASSWORD}
      KC_DB_SCHEMA: public

      KC_LOG_LEVEL: trace
      # KC_LOG_LEVEL_ORG_KEYCLOAK: trace
      
      KC_HEALTH_ENABLED: true
      KC_METRICS_ENABLED: true
      
      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN_USER}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASS}
    healthcheck:
      test: timeout 10s bash -c ':> /dev/tcp/127.0.0.1/8443' || exit 1
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 90s
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      network:
        ipv4_address: 10.5.0.30

If I open up the hostname-debug page from within my network it looks like the image below. If I open it up using my phone (not connected to the home network) it says Frontend, Backend and Admin OK...

What am I doing wrong?

Version

26.3.1

Regression

The issue is a regression

Expected behavior

Keycloak to be usable from within and from outside my home network

Actual behavior

Keycloak isn't usable from within my home network

How to Reproduce?

Use the above docker-compose.yml to configure services
Use the above NGINX configuration
Run docker-compose up
Now go to https://keycloak.some.domain

Anything else?

No response

Answered by shawkins

Jul 22, 2025

I don't think I understand what you're saying about keycloak.some.domain isn't really a public url. When I point the keycloak.some.domain to another entry in my nginx it works and displays the correct page (both in- and outside the network). And if I point it back to keycloak it starts loading, but just doesn't finish loading somehow.. To what do I need to add the hosts entry? The keycloak docker container? The raspberry pi? Every device that needs to use Keycloak?

When you perform an nslookup from a machine on your home network, does it resolve to the expected proxy server? If it does, and you are hitting the hostname debug page via request via that proxy server, then it's not an issue…

View full answer

shawkins · 2025-07-21T22:59:14Z

shawkins
Jul 21, 2025
Collaborator

Note that KC_PROXY_ADDRESS_FORWARDING is not a keycloak option, and KC_HOSTNAME_STRICT does not have an effect if a hostname is set (you should see that in the startup log).

The configured hostname for keycloak is assumed to be public. If you are accessing a front end or admin url, it will need to be via that. With KC_HOSTNAME_BACKCHANNEL_DYNAMIC you will be able to access backchannel urls dynamically from behind the proxy.

In your case it simply sounds like keycloak.some.domain is not really a public url and is not resolvable in your home network. You will likely need to add a hosts entry.

Note also that KC_PROXY_ADDRESS_FORWARDING is not a keycloak option.

4 replies

nmrsmn Jul 22, 2025
Author

Thanks for the quick answer. I've removed the KC_PROXY_ADDRESS_FORWARDING option. I've tried a whole plethora of combinations to get this working but unfortunately haven't found the solution and this was some remnant of my tries haha.

I don't think I understand what you're saying about keycloak.some.domain isn't really a public url. When I point the keycloak.some.domain to another entry in my nginx it works and displays the correct page (both in- and outside the network). And if I point it back to keycloak it starts loading, but just doesn't finish loading somehow.. To what do I need to add the hosts entry? The keycloak docker container? The raspberry pi? Every device that needs to use Keycloak?

Just to be clear; Keycloak isn't my only container and subdomain running and they all work fine from in- and outside of my network, except for Keycloak. The admin console is loading and I do see the H 8000 TML, but other resources don't load

There is one more factor that might have something to do with it (I just realised); My provider make use of dynamic IP's so I'm using DynDNS to point my domain to the right IP using a registered ddns.net subdomain. All my subdomains do point to this ddns.net subdomain using CNAME records.. I'm unsure if this has something to do with the problems, but I wanted to point it out..

nmrsmn Jul 22, 2025
Author

Also; When I open up the url I do get some logging (I've set the log level to be TRACE), but I don't have a clue what this is all about..

opt-keycloak-1  | 2025-07-22 07:03:55,227 DEBUG [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-1) Using X-Forwarded-Proto to set scheme to https
opt-keycloak-1  | 2025-07-22 07:03:55,227 DEBUG [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-1) Using keycloak.some.domain to set host to keycloak.some.domain and port to -1
opt-keycloak-1  | 2025-07-22 07:03:55,227 DEBUG [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-1) Using X-Forwarded-Port to set port to 443
opt-keycloak-1  | 2025-07-22 07:03:55,228 DEBUG [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-1) Recalculated absoluteURI to https://keycloak.some.domain/realms/master/hostname-debug
opt-keycloak-1  | 2025-07-22 07:03:55,228 TRACE [io.vertx.ext.web.impl.RouterImpl] (vert.x-eventloop-thread-1) Router: 754910084 accepting request GET https://keycloak.some.domain/realms/master/hostname-debug
opt-keycloak-1  | 2025-07-22 07:03:55,228 TRACE [io.vertx.ext.web.RoutingContext] (vert.x-eventloop-thread-1) Route matches: RouteState{metadata=null, path='null', name=null, order=-199, enabled=true, methods=null, consumes=null, emptyBodyPermittedWithConsumes=false, produces=null, contextHandlers=[io.quarkus.resteasy.reactive.server.runtime.ResteasyReactiveRecorder$13@7fb07e3], failureHandlers=null, added=true, pattern=null, groups=null, useNormalizedPath=true, namedGroupsInRegex=null, virtualHostPattern=null, pathEndsWithSlash=false, exclusive=false, exactPath=true}
opt-keycloak-1  | 2025-07-22 07:03:55,228 DEBUG [io.quarkus.micrometer.runtime.binder.vertx.VertxHttpServerMetrics] (vert.x-eventloop-thread-1) requestRouted null HttpRequestMetric [initialPath=/realms/master/hostname-debug, currentRoutePath=null, templatePath=null, request=io.vertx.core.http.impl.Http1xServerRequest@438040eb]
opt-keycloak-1  | 2025-07-22 07:03:55,229 TRACE [io.vertx.ext.web.RoutingContext] (vert.x-eventloop-thread-1) Calling the  handler
opt-keycloak-1  | 2025-07-22 07:03:55,229 TRACE [io.vertx.ext.web.RoutingContext] (vert.x-eventloop-thread-1) Route matches: RouteState{metadata=null, path='null', name=null, order=-2, enabled=true, methods=null, consumes=null, emptyBodyPermittedWithConsumes=false, produces=null, contextHandlers=[io.quarkus.vertx.http.runtime.options.HttpServerCommonHandlers$1@aca335d], failureHandlers=null, added=true, pattern=null, groups=null, useNormalizedPath=true, namedGroupsInRegex=null, virtualHostPattern=null, pathEndsWithSlash=false, exclusive=false, exactPath=true}
opt-keycloak-1  | 2025-07-22 07:03:55,229 DEBUG [io.quarkus.micrometer.runtime.binder.vertx.VertxHttpServerMetrics] (vert.x-eventloop-thread-1) requestRouted null HttpRequestMetric [initialPath=/realms/master/hostname-debug, currentRoutePath=null,
8000
 templatePath=null, request=io.vertx.core.http.impl.Http1xServerRequest@438040eb]
opt-keycloak-1  | 2025-07-22 07:03:55,229 TRACE [io.vertx.ext.web.RoutingContext] (vert.x-eventloop-thread-1) Calling the  handler
opt-keycloak-1  | 2025-07-22 07:03:55,229 TRACE [io.vertx.ext.web.RoutingContext] (vert.x-eventloop-thread-1) Route matches: RouteState{metadata=null, path='/', name=null, order=20500, enabled=true, methods=null, consumes=null, emptyBodyPermittedWithConsumes=false, produces=null, contextHandlers=[org.jboss.resteasy.reactive.server.vertx.ResteasyReactiveVertxHandler@103535ff], failureHandlers=null, added=true, pattern=null, groups=null, useNormalizedPath=true, namedGroupsInRegex=null, virtualHostPattern=null, pathEndsWithSlash=true, exclusive=false, exactPath=false}
opt-keycloak-1  | 2025-07-22 07:03:55,229 DEBUG [io.quarkus.micrometer.runtime.binder.vertx.VertxHttpServerMetrics] (vert.x-eventloop-thread-1) requestRouted / HttpRequestMetric [initialPath=/realms/master/hostname-debug, currentRoutePath=null, templatePath=null, request=io.vertx.core.http.impl.Http1xServerRequest@438040eb]
opt-keycloak-1  | 2025-07-22 07:03:55,230 TRACE [io.vertx.ext.web.RoutingContext] (vert.x-eventloop-thread-1) Calling the  handler
opt-keycloak-1  | 2025-07-22 07:03:55,235 TRACE [io.quarkus.arc.requestContext] (executor-thread-1) Activate new 
opt-keycloak-1  | 	io.quarkus.arc.impl.CurrentManagedContext.activate(CurrentManagedContext.java:60)
opt-keycloak-1  | 	io.quarkus.arc.ManagedContext.activate(ManagedContext.java:19)
opt-keycloak-1  | 	io.quarkus.resteasy.reactive.common.runtime.ArcThreadSetupAction.activateInitial(ArcThreadSetupAction.java:18)
opt-keycloak-1  | 	org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.requireCDIRequestScope(AbstractResteasyReactiveContext.java:256)
opt-keycloak-1  | 	org.jboss.resteasy.reactive.server.handlers.ParameterHandler.handle(ParameterHandler.java:43)
opt-keycloak-1  | 	io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:137)
opt-keycloak-1  | 	org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)
opt-keycloak-1  | 	...
opt-keycloak-1  | 2025-07-22 07:03:55,238 TRACE [org.keycloak.services.DefaultKeycloakSession] (executor-thread-1) Created session @ 72c1edc0
opt-keycloak-1  |     org.keycloak.services.DefaultKeycloakSession.<init>(DefaultKeycloakSession.java:93)
opt-keycloak-1  |     org.keycloak.quarkus.runtime.integration.QuarkusKeycloakSession.<init>(QuarkusKeycloakSession.java:29)
opt-keycloak-1  |     org.keycloak.quarkus.runtime.integration.QuarkusKeycloakSessionFactory.create(QuarkusKeycloakSessionFactory.java:107)
opt-keycloak-1  |     org.keycloak.quarkus.runtime.transaction.TransactionalSessionHandler.create(TransactionalSessionHandler.java:38)
opt-keycloak-1  |     org.keycloak.quarkus.runtime.integration.cdi.KeycloakBeanProducer.getKeycloakSession(KeycloakBeanProducer.java:36)
opt-keycloak-1  |     org.keycloak.quarkus.runtime.integration.cdi.KeycloakBeanProducer_ProducerMethod_getKeycloakSession_XoSEUTXOsE3bpqXlGMAykCiECUM_Bean.doCreate(Unknown Source)
opt-keycloak-1  |     org.keycloak.quarkus.runtime.integration.cdi.KeycloakBeanProducer_ProducerMethod_getKeycloakSession_XoSEUTXOsE3bpqXlGMAykCiECUM_Bean.create(Unknown Source)
opt-keycloak-1  |     org.keycloak.quarkus.runtime.integration.cdi.KeycloakBeanProducer_ProducerMethod_getKeycloakSession_XoSEUTXOsE3bpqXlGMAykCiECUM_Bean.create(Unknown Source)
opt-keycloak-1  |     org.keycloak.models.KeycloakBeanProducer_ProducerMethod_getKeycloakSession_XoSEUTXOsE3bpqXlGMAykCiECUM_ClientProxy.arc$delegate(Unknown Source)
opt-keycloak-1  |     org.keycloak.models.KeycloakBeanProducer_ProducerMethod_getKeycloakSession_XoSEUTXOsE3bpqXlGMAykCiECUM_ClientProxy.getTransactionManager(Unknown Source)
opt-keycloak-1  |     org.keycloak.quarkus.runtime.transaction.TransactionalSessionHandler.beginTransaction(TransactionalSessionHandler.java:47)
opt-keycloak-1  |     org.keycloak.quarkus.runtime.integration.resteasy.TransactionalSessionHandler.handle(TransactionalSessionHandler.java:36)
opt-keycloak-1  | 2025-07-22 07:03:55,241 TRACE [com.arjuna.ats.jta] (executor-thread-1) TransactionImpleManager.suspend
opt-keycloak-1  | 2025-07-22 07:03:55,241 TRACE [com.arjuna.ats.jta] (executor-thread-1) BaseTransaction.begin
opt-keycloak-1  | 2025-07-22 07:03:55,242 TRACE [com.arjuna.ats.arjuna] (executor-thread-1) StateManager::StateManager( 2, 0 )
opt-keycloak-1  | 2025-07-22 07:03:55,242 TRACE [com.arjuna.ats.arjuna] (executor-thread-1) BasicAction::BasicAction()
opt-keycloak-1  | 2025-07-22 07:03:55,243 TRACE [com.arjuna.ats.arjuna] (executor-thread-1) BasicAction::Begin() for action-id 0:ffff0a05001e:841d:687f36c8:1f
opt-keycloak-1  | 2025-07-22 07:03:55,243 TRACE [com.arjuna.ats.arjuna] (executor-thread-1) BasicAction::actionInitialise() for action-id 0:ffff0a05001e:841d:687f36c8:1f
opt-keycloak-1  | 2025-07-22 07:03:55,244 TRACE [com.arjuna.ats.arjuna] (executor-thread-1) ActionHierarchy::ActionHierarchy(1)
opt-keycloak-1  | 2025-07-22 07:03:55,244 TRACE [com.arjuna.ats.arjuna] (executor-thread-1) ActionHierarchy::add(0:ffff0a05001e:841d:687f36c8:1f, 1)
opt-keycloak-1  | 2025-07-22 07:03:55,245 TRACE [com.arjuna.ats.arjuna] (executor-thread-1) BasicAction::addChildThread () action 0:ffff0a05001e:841d:687f36c8:1f adding Thread[#28,executor-thread-1,5,main]
opt-keycloak-1  | 2025-07-22 07:03:55,245 TRACE [com.arjuna.ats.arjuna] (executor-thread-1) BasicAction::addChildThread () action 0:ffff0a05001e:841d:687f36c8:1f adding Thread[#28,executor-thread-1,5,main] result = true
opt-keycloak-1  | 2025-07-22 07:03:55,246 TRACE [com.arjuna.ats.arjuna] (executor-thread-1) TransactionReaper::insert ( BasicAction: 0:ffff0a05001e:841d:687f36c8:1f status: ActionStatus.RUNNING, 300 )
opt-keycloak-1  | 2025-07-22 07:03:55,246 TRACE [com.arjuna.ats.arjuna] (executor-thread-1) ReaperElement::ReaperElement ( BasicAction: 0:ffff0a05001e:841d:687f36c8:1f status: ActionStatus.RUNNING, 300 )
opt-keycloak-1  | 2025-07-22 07:03:55,247 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) new JtaTransactionWrapper. Was existing transaction suspended: false Request context: HTTP GET https://keycloak.some.domain/realms/master/hostname-debug, Transaction: TransactionImple < ac, BasicAction: 0:ffff0a05001e:841d:687f36c8:1f status: ActionStatus.RUNNING >
opt-keycloak-1  | 2025-07-22 07:03:55,249 TRACE [org.infinispan.interceptors.impl.InvocationContextInterceptor] (executor-thread-1) Invoked realmRevisions with command GetKeyValueCommand {key=realm.query.by.name.master, flags=[]} and InvocationContext [SingleKeyNonTxInvocationContext{isLocked=false, key=null, cacheEntry=null, origin=null, lockOwner=null}]
opt-keycloak-1  | 2025-07-22 07:03:55,249 TRACE [org.infinispan.container.impl.EntryFactoryImpl] (executor-thread-1) Exists in context? null 
opt-keycloak-1  | 2025-07-22 07:03:55,250 TRACE [org.infinispan.container.impl.EntryFactoryImpl] (executor-thread-1) Retrieved from container ImmortalCacheEntry{key=realm.query.by.name.master, value=0, internalMetadata=null}
opt-keycloak-1  | 2025-07-22 07:03:55,251 TRACE [org.infinispan.container.impl.EntryFactoryImpl] (executor-thread-1) Creating new entry for key realm.query.by.name.master
opt-keycloak-1  | 2025-07-22 07:03:55,251 TRACE [org.infinispan.container.impl.EntryFactoryImpl] (executor-thread-1) Wrap realm.query.by.name.master for read. Entry=RepeatableReadEntry(25961195){key=realm.query.by.name.master, value=0, oldValue=0, isCreated=false, isChanged=false, isRemoved=false, isExpired=false, isCommited=false, skipLookup=false, metadata=EmbeddedMetadata{version=null}, oldMetadata=EmbeddedMetadata{version=null}, internalMetadata=null}
opt-keycloak-1  | 2025-07-22 07:03:55,252 TRACE [org.infinispan.interceptors.impl.CallInterceptor] (executor-thread-1) Invoking: GetKeyValueCommand
opt-keycloak-1  | 2025-07-22 07:03:55,253 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (executor-thread-1) realm by name cache hit: master
opt-keycloak-1  | 2025-07-22 07:03:55,253 TRACE [org.infinispan.interceptors.impl.InvocationContextInterceptor] (executor-thread-1) Invoked realmRevisions with command GetKeyValueCommand {key=8b8ab390-a22d-4f56-a975-e87d2470df3a, flags=[]} and InvocationContext [SingleKeyNonTxInvocationContext{isLocked=false, key=null, cacheEntry=null, origin=null, lockOwner=null}]
opt-keycloak-1  | 2025-07-22 07:03:55,254 TRACE [org.infinispan.container.impl.EntryFactoryImpl] (executor-thread-1) Exists in context? null 
opt-keycloak-1  | 2025-07-22 07:03:55,254 TRACE [org.infinispan.container.impl.EntryFactoryImpl] (executor-thread-1) Retrieved from container ImmortalCacheEntry{key=8b8ab390-a22d-4f56-a975-e87d2470df3a, value=0, internalMetadata=null}
opt-keycloak-1  | 2025-07-22 07:03:55,255 TRACE [org.infinispan.container.impl.EntryFactoryImpl] (executor-thread-1) Creating new entry for key 8b8ab390-a22d-4f56-a975-e87d2470df3a
opt-keycloak-1  | 2025-07-22 07:03:55,255 TRACE [org.infinispan.container.impl.EntryFactoryImpl] (executor-thread-1) Wrap 8b8ab390-a22d-4f56-a975-e87d2470df3a for read. Entry=RepeatableReadEntry(1b7bc358){key=8b8ab390-a22d-4f56-a975-e87d2470df3a, value=0, oldValue=0, isCreated=false, isChanged=false, isRemoved=false, isExpired=false, isCommited=false, skipLookup=false, metadata=EmbeddedMetadata{version=null}, oldMetadata=EmbeddedMetadata{version=null}, internalMetadata=null}
opt-keycloak-1  | 2025-07-22 07:03:55,256 TRACE [org.infinispan.interceptors.impl.CallInterceptor] (executor-thread-1) Invoking: GetKeyValueCommand
opt-keycloak-1  | 2025-07-22 07:03:55,256 TRACE [org.keycloak.models.cache.infinispan.RealmCacheSession] (executor-thread-1) by id cache hit: master
opt-keycloak-1  | 2025-07-22 07:03:55,267 FINE  [freemarker.cache] (executor-thread-1) Couldn't find template in cache for "debug-hostname-settings.ftl"("en_US", UTF-8, parsed); will try to load it.
opt-keycloak-1  | 2025-07-22 07:03:55,268 FINE  [freemarker.cache] (executor-thread-1) TemplateLoader.findTemplateSource("debug-hostname-settings_en_US.ftl"): Not found
opt-keycloak-1  | 2025-07-22 07:03:55,268 FINE  [freemarker.cache] (executor-thread-1) TemplateLoader.findTemplateSource("debug-hostname-settings_en.ftl"): Not found
opt-keycloak-1  | 2025-07-22 07:03:55,270 FINE  [freemarker.cache] (executor-thread-1) TemplateLoader.findTemplateSource("debug-hostname-settings.ftl"): Found
opt-keycloak-1  | 2025-07-22 07:03:55,270 FINE  [freemarker.cache] (executor-thread-1) Loading template for "debug-hostname-settings.ftl"("en_US", UTF-8, parsed) from "jar:file:/opt/keycloak/lib/lib/main/org.keycloak.keycloak-quarkus-server-26.3.1.jar!/theme-resources/templates/debug-hostname-settings.ftl"
opt-keycloak-1  | 2025-07-22 07:03:55,294 TRACE [com.arjuna.ats.jta] (executor-thread-1) TransactionImple.getStatus: jakarta.transaction.Status.STATUS_ACTIVE
opt-keycloak-1  | 2025-07-22 07:03:55,295 TRACE [org.keycloak.services.DefaultKeycloakSession] (executor-thread-1) Closing session @ 72c1edc0 (transaction active)
opt-keycloak-1  |     org.keycloak.services.DefaultKeycloakSession.close(DefaultKeycloakSession.java:348)
opt-keycloak-1  |     org.keycloak.models.KeycloakBeanProducer_ProducerMethod_getKeycloakSession_XoSEUTXOsE3bpqXlGMAykCiECUM_ClientProxy.close(Unknown Source)
opt-keycloak-1  |     org.keycloak.quarkus.runtime.transaction.TransactionalSessionHandler.close(TransactionalSessionHandler.java:60)
opt-keycloak-1  |     org.keycloak.quarkus.runtime.integration.jaxrs.CloseSessionFilter.closeSession(CloseSessionFilter.java:67)
opt-keycloak-1  |     org.keycloak.quarkus.runtime.integration.jaxrs.CloseSessionFilter.filter(CloseSessionFilter.java:63)
opt-keycloak-1  | 2025-07-22 07:03:55,296 TRACE [com.arjuna.ats.jta] (executor-thread-1) TransactionImple.getStatus: jakarta.transaction.Status.STATUS_ACTIVE
opt-keycloak-1  | 2025-07-22 07:03:55,297 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) JtaTransactionWrapper  commit. Request context: HTTP GET https://keycloak.some.domain/realms/master/hostname-debug, Transaction: TransactionImple < ac, BasicAction: 0:ffff0a05001e:841d:687f36c8:1f status: ActionStatus.RUNNING >
opt-keycloak-1  | 2025-07-22 07:03:55,297 TRACE [com.arjuna.ats.jta] (executor-thread-1) BaseTransaction.commit
opt-keycloak-1  | 2025-07-22 07:03:55,297 TRACE [com.arjuna.ats.jta] (executor-thread-1) TransactionImple.commitAndDisassociate
opt-keycloak-1  | 2025-07-22 07:03:55,298 TRACE [com.arjuna.ats.arjuna] (executor-thread-1) BasicAction::End() for action-id 0:ffff0a05001e:841d:687f36c8:1f
opt-keycloak-1  | 2025-07-22 07:03:55,298 TRACE [com.arjuna.ats.arjuna] (executor-thread-1) BasicAction::End() result for action-id (0:ffff0a05001e:841d:687f36c8:1f) is (TwoPhaseOutcome.PREPARE_OK) node id: (quarkus)
opt-keycloak-1  | 2025-07-22 07:03:55,299 TRACE [com.arjuna.ats.arjuna] (executor-thread-1) BasicAction::removeChildThread () action 0:ffff0a05001e:841d:687f36c8:1f removing 2
opt-keycloak-1  | 2025-07-22 07:03:55,299 TRACE [com.arjuna.ats.arjuna] (executor-thread-1) BasicAction::removeChildThread () action 0:ffff0a05001e:841d:687f36c8:1f removing 2 result = true
opt-keycloak-1  | 2025-07-22 07:03:55,299 TRACE [com.arjuna.ats.arjuna] (executor-thread-1) TransactionReaper::remove ( BasicAction: 0:ffff0a05001e:841d:687f36c8:1f status: ActionStatus.COMMITTED )
opt-keycloak-1  | 2025-07-22 07:03:55,300 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) JtaTransactionWrapper end. Request context: HTTP GET https://keycloak.some.domain/realms/master/hostname-debug, Transaction: TransactionImple < ac, BasicAction: 0:ffff0a05001e:841d:687f36c8:1f status: ActionStatus.COMMITTED >

shawkins Jul 22, 2025
Collaborator

I don't think I understand what you're saying about keycloak.some.domain isn't really a public url. When I point the keycloak.some.domain to another entry in my nginx it works and displays the correct page (both in- and outside the network). And if I point it back to keycloak it starts loading, but just doesn't finish loading somehow.. To what do I need to add the hosts entry? The keycloak docker container? The raspberry pi? Every device that needs to use Keycloak?

When you perform an nslookup from a machine on your home network, does it resolve to the expected proxy server? If it does, and you are hitting the hostname debug page via request via that proxy server, then it's not an issue with DNS.

The hostname debug page is using javascript to hit a test url below the ones shown. So in this case the timeouts indicate something is wrong with reaching https://keycloak.some.domain/realms/master/hostname-debug/test - which seems odd if you were able to successfully access https://keycloak.some.domain/realms/master/hostname-debug

With dev tools enabled in the browser try directly hitting https://keycloak.some.domain/realms/master/hostname-debug/test to see what the client is seeing, and what shows up in the server logs.

Also; When I open up the url I do get some logging (I've set the log level to be TRACE), but I don't have a clue what this is all about..

It looks like a normal log of the request processing.

Answer selected by nmrsmn

nmrsmn Jul 22, 2025
Author

So when I did a nslookup from one of the machines in the network it pointed to my registered dyndns/ddns.net domain..
I've installed pi-hole, pointed keycloak.some.domain to the raspberry pi internal IP and now it works..

I'm no DNS expert but it seems like the DNS was causing troubles by pointing keycloak to the outside, which then resolved back to my router etc. etc.

Navigation Menu

Repository navigation

Keycloak admin console not loading with the docker container being behind reverse proxy #41305

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 4 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Keycloak admin console not loading with the docker container being behind reverse proxy #41305

Uh oh!

nmrsmn Jul 21, 2025

Before reporting an issue

Area

Describe the bug

Version

Regression

Expected behavior

Actual behavior

How to Reproduce?

Anything else?

Replies: 1 comment · 4 replies

Uh oh!

shawkins Jul 21, 2025 Collaborator

Uh oh!

nmrsmn Jul 22, 2025 Author

Uh oh!

nmrsmn Jul 22, 2025 Author

Uh oh!

shawkins Jul 22, 2025 Collaborator

Uh oh!

nmrsmn Jul 22, 2025 Author

nmrsmn
Jul 21, 2025

Replies: 1 comment 4 replies

shawkins
Jul 21, 2025
Collaborator

nmrsmn Jul 22, 2025
Author

nmrsmn Jul 22, 2025
Author

shawkins Jul 22, 2025
Collaborator

nmrsmn Jul 22, 2025
Author